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Claims 

1 . A method for preventing an hostile use of computer resources by an application 
running on a workstation, comprising the steps of: 

a) providing a list of services that are not allowed for access by unspecified 
applications; 

b) when such unspecified application runs on the workstation, preventing said 
application from accessing any resource directly; 

c) analyzing any direct or indirect request for access to specific services, to 
determine whether such request is allowable according to the list defined under a) 
above; 

d) if the request is allowable, allowing the workstation to process it; and 

e) if the request is not allowable, preventing the unspecified application from 
accessing the requested resource; 

wherein said resource may be any local or remote resource, including, but not limited to, 
memory allocation, files, directories, operations with files and directories, such as copy, 
delete or compress, or any other operation leading to a permanent change in the 
workstation or its periphery. 

2. A method according to claim 1, wherein the list of services is provided as a look-up 
table. 
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3. A method according to claim 1 or 2, wherein an unspecified application is an 
application which is itot specifically identified in a pre-set list of applications. 

4. A method according to claim 3, wherein the pre-set list of applications includes a list 
of resources which each application may utilize. 

5. An agent for protecting a workstation against the hostile use of computer resources by 
an unspecified application running on said workstation, comprising: 

a) means for detecting an unspecified application running on the workstation; 

b) means for determining the requests for resources to be used by said 
unspecified application; 

c) means for identifying chain requests for resources utilization, wherein said 
chain requests comprise requests made by resources called by said unspecified 
application; 

d) means for determining whether requests made directly by said unspecified 
application are allowable; 

e) means for determining whether requests made indirectly, as chain requests, by 
said unspecified application would be not allowable if made directly by said unspecified 
application; and 

f) means for preventing said chain request from being processed, if it is 
determined that the request is not allowable, or that it would not be allowable if made 
directly by said unspecified application, and for allowing its processing if otherwise 
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determined. 

6. An agent according to claim 5, wherein the means for determining whether requests 
made directly or indirectly by said unspecified application are allowable comprise a 
look-up table including a list of services that are not allowed for access by unspecified 
applications. 

77^n^gent according to claim 5 or 6, wherein said resource may be any local or remote 
resource, including, but not limited to, memory allocation, files, directories, operations 
with files and directories, such as copy, delete or compress, or any other operation 
leading to a permanent chan^ein the workstation or its periphery. 



8. An agent according to any one of claims 5 to 7, comprising a pre-set list of 
applications including a list of resources which each^pplication may utilize. 



